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Abstract 

We propose a quantum key distribution (QKD) protocol that enables 
three parties agree at once on a shared common random bit string in 
presence of an eavesdropper without use of entanglement. We prove its 
unconditional security and analyze the key rate. 

1 Introduction 

When a sender, Alice, wants to send a confidential message to single receiver. 
Bob, over a public communication channel in an unconditionally secure way, 
they have to share a secret common random bit string, which is usually called 
a secret key. Such a secret key can be shared by a quantum key distribution 
(QKD) protocol, such as the BB84 protocol [U [7] even when there is an eaves- 
dropper. Eve, with unlimited computational power. 

When Alice sends a confidential message by broadcast to two receivers. Bob 
and Charlie, these three parties have to share a common secret key. We pro- 
pose a protocol enabling them to share such a secret key under the assumption 
that there are point-to-point quantum channels from Alice to Bob and Charlie 
whose message can be eavesdropped and modified by Eve and three point-to- 
point classical channels among Alice, Bob and Charlie whose message can be 
eavesdropped but cannot be modified by Eve. Eve is assumed to do whatever 
manipulation on quantum systems transmitted over the quantum channels al- 
lowed by the quantum mechanics. This assumption is the same as Ref. [3] and 
is a multiparty generalization of that in Ref. [7] . This problem is called the mul- 
tiparty key distribution or conference key agreement. Under this assumption 
we prove the unconditional security and give a lower bound on the key rate. 

As a prior relevant research, it was pointed out in Ref. [5] that Alice can 
secretly send a key after two different secret keys are shared between Alice and 
Bob and between Alice and Charlie by a conventional two party QKD protocol 
such as Ref. [1] . The difference of our proposed protocol to Ref. [8] is that our 
protocol allows three parties to share a secret key at once. 
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As another prior relevant research, Chen and Lo [5] proposed a protocol for 
the same goal as our proposed protocol. In their protocol, Alice has to prepare 
the Bell state while in our protocol she does not need an entangled quantum 
state, which makes our protocol easier to implement with current technology 
than theirs [3]. Our protocol is the first multiparty QKD protocol that does 
not use entangled state. It is also worth noting that the security proof for our 
protocol does not use multipartite entanglement distillation 6] , while Chen and 
Lo |3] use it. 

This paper is organized as follows: Section 2 presents the proposed protocol. 
Section 3 shows an unconditional security proof and a lower bound on its key 
rate. Section 4 gives concluding remarks. 

2 Protocol 

In this section we describe our proposed protocol. Let |0), |1) be an orthonormal 
basis for a qubit state space, and |+) = (|0) + |1))/a/2, |-) = (|0) + |1))/V2. 
We also define the matrices X and Z representing the bit error and the phase 
error, respectively, as 

X|0) = |1), ,X|1) = |0), 
Z\+) = \-), ,Z\-) = \+). 

1. Alice makes a random qubit sequence according to the i.i.d. uniform dis- 
tribution on {|0), 1+), |— )} and sends it to Bob. Alice also sends the 
same qubit sequence to Charlie. 

2. Bob chooses the {|0), |1)} basis or {|+), |— )} basis uniformly randomly 
for each received qubit and measure it by the chosen basis. 

3. Charlie does the same thing as StepHJ 

4. Alice publicly announces which basis {|0), |1)} or {|+), |— )} each trans- 
mitted qubit belongs to. Bob and Charlie also publicly announce which 
bases were used for measurement of each qubit. In the following steps 
they will only consider qubits with which transmission basis and measur- 
ing bases coincide among all of them. 

5. Suppose that there are 2n qubits transmitted in the {|0), |1)} basis and 
measured with the {|0), |1)} basis by both Bob and Charlie. Index those 
qubits by 1, . . . , 2n. Define the bit = if Alice's i-th qubit was |0), and 
ai — 1 otherwise. Define the bit 6i = if Bob's measurement outcome for 
i-th qubit was |0), and h = 1 otherwise. Define the bit Ci = if Charlie's 
measurement outcome for i-th qubit was |0), and Ci = 1 otherwise. 

6. Suppose also that there are 2n' qubits transmitted in the {|+), |— )} basis 
and measured with the {|+), |— )} basis by both Bob and Charlie. Index 
those qubits by 1, . . . , 2n'. Define the bit a; = if Alice's i-th qubit was 
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and Ui = 1 otherwise. Define the bit = if Bob's measurement 
outcome for i-ih qubit was |+), and Pi = 1 otherwise. Define the bit 
7i = if Charlie's measurement outcome for i-th qubit was |+), and 
7i = 1 otherwise. 

For the simplicity of the presentation, we will describe the procedure extracting 
the secret key from a,, bi and Ci. 

7. Alice chooses a subset 5* C {1, . . . , 2n} with size l^l = n uniformly 
randomly from subsets of { 1 , . . . , 2n} , and publicly announces the choice 
of S. Alice, Bob and Charlie publicly announce Ui, bi and Cj for i e S and 
compute the error rate 



qi = max 



\{teS\a,y^ &JI \{ieS\a,y^ c,}| 



Alice chooses a subset S' C {1, 2n'} with size = n' uniformly 

randomly from subsets of {1, . . . , 2n'}, and publicly announces the choice 
of S'. Alice, Bob and Charlie publicly announce /3j and 7i for i G S' 
and compute the error rate 

\{i G S' \ ai = ji Pi or ai = pii= 7i}| 
0.2 = r^, • (1) 



Observe the difference between the definitions for qi and q2- 

9. Alice, Bob and Charlie decide a linear code Ci of length n such that its 
decoding error probability is sufficiently small over all the binary symmet- 
ric channel whose crossover probability is close to qi . Let Hi be a parity 
check matrix for Ci, a be Alice's remaining (not announced) bits among 
a,'s, b be Bob's remaining bits among 6j's, and c be Charlie's remaining 
bits among Cj's. 

10. Alice publicly announces the syndrome Hici. 

11. Bob compute the error vector / such that Hif = Hib — Hia hy the 
decoding algorithm for Ci . With high probability b — f = a. 

12. Charlie compute the error vector /' such that Hif = HiC — Hia by the 
decoding algorithm for Ci. With high probability c— f = a. 

13. Alice chooses a subspace C2 C Ci with dimC2 = nh{q2) uniformly ran- 
domly, where h denotes the binary entropy function, and publicly an- 
nounces her choice of C2. The final shared secret key is the coset a + C2. 
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3 Security proof and a lower bound on the key 
rate 



We shall show the unconditional security of our proposed protocol by directly 
relating it to the quantum error correction by the quantum CSS (Calderbank- 
Shor-Steane) codes [HIHj- To make this paper self-contained, we shall briefly 
review the CSS code. 



3.1 Review of the CSS code 

For a binary vector v = (wi, . . . , Vn) G , where F2 is the Galois field with 
two elements, we define the quantum state vector \v) by 

\v) = \vi) ® \V2) \Vn). 

For two binary linear codes C2 C Ci C , the CSS code is the complex linear 
space spanned by the vectors 



1*^21 ^ec2 



for all w e Ci. We also need parameterized CSS codes introduced in Ref. [7]. 
The parameterized CSS code for x, i* g F2 is defined as the linear space spanned 

by 



for all u e Ci, where (•, •) denotes the inner product. 

For a linear code C of length n, define the linear code CC of length 2n and 
dimension dim C by 

{cc I c e C}, 

where cc* is the concatenated vector of length 2n. In the security proof of our 
protocol, we have to consider the CSS code defined by the pair of linear codes 
CiCi D C2C2, whose orthonormal basis is given by 

— T==7 \v + w)\v + w). 

For vectors x and z e Fj of length n, we define the parameterized CSS code as 
the complex linear space spanned by 

1 ^ (_ ^) \:S+v + nj)\x + v + w), (2) 



^^C2 

for u S Ci . Using the parameterized CSS code defined in Eq. ^ , we shall show 
a security proof of our protocol. 
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3.2 Security proof and analysis of the key rate 



We shall first show that our protocol is equivalent to sending a parameterized 
CSS codeword with the parameter z randomly chosen. If we fix v and x and 
choose z uniformly randomly in Eq. ^ , then the resulting density operator is 



by the exactly same argument as Ref. [?]• 

Denote the right hand side of Eq. ^ by p{x,v). By a straightforward 
computation we can see 



The right hand side of Eq. ^ means sending |00) or |11) n times with equal 
probability, which is exactly what Alice is doing in our protocol. Announcing 
the syndrome Hid in Step [10] is equivalent to announcing which x is chosen. 

We shall consider the decoding of the imaginary transmission of CSS code- 
words. A good review of decoding of CSS codes is provided in Ref. |7]. We 
regard Bob and Charlie as a single receiver. The bit error correction is actually 
performed in our protocol, therefore we have to ensure that it can be separately 
executed by Bob and Charlie. On the other hand, the phase error correction is 
not actually performed, so it has not to be separately executable. 

Observe that the bit error correction for the leftmost n qubits in the CSS 
code defined in Eq. ([2]) can be done separately from the rightmost n qubits in 
Eq. which means that Bob and Charlie can correct their bit flip errors with 
their local operations and that they do not need their cooperation for bit error 
correction. 

We shall consider the phase error correction. Let Zi be the phase error 
occurred at i-th qubit in Eq. ([2|). We can see that Zi and Zn+i have the same 
effect on the quantum codeword in Eq. ([2]), and that Zi (g) Zn+i does not change 
the quantum codeword in Eq. 




\x + V + w)\x + V + w) {x + V + w\{x + V + wl, (3) 





aSFJ 



Let 
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be a parity check matrix for , then 



hihi 



dim C2 ^n — dim C2 



is a parity check matrix for ((726*2)^. 
Suppose that a phase error 



(5) 



occm'red with the quantum state ([2]), where Zj S F2 for i = 1, . . . , 2n. Let 
e = (zi, . . . , Z2n) G F2". From the measurement outcomes in the phase error 
correction process, we can know 



ior i — 1, . . . , n — dimC2. Observe that the error ([5]) and 



(6) 



Z^i (g) • • • (Ki Z""^" 



has the same effect on the state ([2]) if Zi + Zn+i = z ■ + for all i, where the 
addition is considered in F2. Thus, in order to correct phase errors, we have to 
find the binary vector 

e' (ei + e„+j, . . . ,e„ + e2„) (7) 
from the data given in Eq. ^ . Also observe that 

{hihi,e) = {hi,e'). 

Finding e' from {hi , e') is exactly the ordinary decoding process for the classical 
linear code . Also observe that the probability of + e„+i = 1 is given by 
q2 in Eq. ([T]) in our situation. 

It is proved in Ref. [TOj that random choice of [n — /i(g2)]-dimensional sub- 
space C2 in Ci almost always gives the low phase error decoding probability. 
This fact is also stated without proof in Ref. ^ . If the choice of Ci is appropri- 
ate, then the fidelity of quantum error correction in the imaginary transmission 
of the CSS codeword ^ is close to 1, which implies that the eavesdropper Eve 
can obtain little information by the same argument as Ref. 5J , which shows the 
security of the BB84 protocol directly relating it to the quantum error correction 
without use of entanglement distillation argument. 

It was shown in Corollary 2 of Ref. Q that there exists a linear code Ci of 
information rate 1 — h{qi) satisfying the condition in Step [HI Therefore, we can 
extract 1 — h(qi) — h{q2) bit of secret key from one bit of the raw bits a. 
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4 Conclusion and Discussion 



We have proposed a protocol that aUows Ahce, Bob and Charhe to share a 
common secret key at once. This is the first such protocol without use of 
entangled states. However, the amount of extracted common secret key per 
single photon transmission is lower than the repeated use of the BB84 protocol 
and the well-known postprocessing described in Ref. f5|. Finding a multiparty 
QKD protocol with higher efficiency is a future research agenda. 
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